The static CI secret — a cloud access key sitting in a variables store — is on its way out. In 2026, OIDC federation and trusted publishing are the recommended defaults across GitHub, GitLab and the major cloud providers, exchanging long-lived credentials for short-lived tokens scoped to a single workflow run.
The problem with static credentials
A long-lived cloud key stored in CI settings is one misconfigured workflow away from leaking. Every repository with access to that secret inherits the risk, and rotation is rare because rotation breaks things.
How OIDC fixes it
The CI platform authenticates the workflow run and exchanges an identity token for a short-lived credential scoped to a specific role. Nothing persistent is stored, the credential expires in minutes, and cloud-side trust policies can restrict which repositories and branches may assume the role.
Migration order
Start with the least critical deployment target, add the trust policy alongside the existing secret, verify the workflow runs, then remove the static key. Repeat per target. The pattern is repetitive but each step is independently reversible.
How the exchange works
Instead of storing an access key, the pipeline requests a token from the identity provider proving which repository, branch and workflow is running; the cloud trusts that identity and issues temporary credentials with a role's exact permissions. The credential dies with the job. For package registries the same principle appears as trusted publishing: the registry trusts releases minted by a specific CI identity, so no upload token exists anywhere in the pipeline.
Migration without downtime
Inventory every static credential first — including the ones nobody remembers creating — then migrate one workflow at a time with both paths active, and revoke the static key only after the OIDC path has run successfully in production for a week. Watch the classic pitfalls: clock skew breaking token validation, overly broad trust policies that accept any branch, and role definitions that quietly exceed the permission set the old key had.
Key takeaways
- OIDC replaces stored keys with per-run, short-lived credentials.
- Trust policies must pin repository, branch and workflow — not just the repo.
- Revoke static keys only after a week of successful OIDC runs.
Final thoughts
Killing CI secrets is one of the highest-leverage security migrations available: it removes an entire class of leak incidents and enforces least privilege by construction rather than by review.